chore: harden workflow action configurations

.github/actions/check-collaborator/action.yml

@@ -41,7 +41,7 @@ runs:
   steps:
     - name: Check collaborator authorization
       id: check
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         # Passed via env (not ${{ }} interpolation) so an attacker-controlled login
         # on pull_request_target cannot inject into the script body.

.github/actions/fetch-secrets/action.yml

@@ -42,7 +42,7 @@ runs:
         registerMask(process.env.ROLE_ARN);
 
     - name: Configure AWS credentials (central secrets reader)
-      uses: aws-actions/configure-aws-credentials@v6
+      uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
       with:
         role-to-assume: ${{ inputs.role-arn }}
         aws-region: ${{ inputs.aws-region }}
@@ -62,7 +62,7 @@ runs:
         main();
 
     - name: Fetch secrets
-      uses: aws-actions/aws-secretsmanager-get-secrets@v2
+      uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10
       with:
         secret-ids: ${{ steps.build.outputs.mappings }}
         parse-json-secrets: false

.github/actions/strands-action/action.yml

@@ -97,7 +97,7 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         fetch-depth: 0
 
@@ -110,19 +110,19 @@ runs:
 
     - name: Configure AWS (Bedrock only)
       if: inputs.provider == 'bedrock' && inputs.aws_role_arn != ''
-      uses: aws-actions/configure-aws-credentials@v5
+      uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
       with:
         role-to-assume: ${{ inputs.aws_role_arn }}
         aws-region: ${{ inputs.aws_region }}
         mask-aws-account-id: true
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: '3.13'
 
     - name: Setup Python & uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       with:
         enable-cache: true
 

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /.github/actions/check-collaborator
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /.github/actions/fetch-secrets
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /.github/actions/strands-action
+    schedule:
+      interval: weekly

.github/workflows/reusable-agent-restricted.yml

@@ -117,7 +117,7 @@ jobs:
     runs-on: ${{ inputs.runner == 'codebuild' && format('codebuild-agentcore-e2e-{0}-{1}', github.run_id, github.run_attempt) || 'ubuntu-latest' }}
     steps:
       - name: Fetch secrets from Secrets Manager
-        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74
+        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
         with:
           role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
           repo: AUTHORIZED_USERS, AWS_ROLE_ARN
@@ -137,23 +137,23 @@ jobs:
       # own files in the workspace. The strands-action composite and its runner scripts are NOT
       # taken from here — they're bundled with the centrally-hosted action in the devtools repo.
       - name: Checkout caller repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.sha }}
           fetch-depth: 0
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Run Strands Agent
         # Centralized action hosted in this devtools repo (a `uses: ./` local ref would
         # resolve against devtools from a reusable anyway, and the caller has no copy).
-        uses: aws/agentcore-devx-devtools/.github/actions/strands-action@31aa3b031a86664e29861d68956e44b07cf21a74
+        uses: aws/agentcore-devx-devtools/.github/actions/strands-action@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
         with:
           prompt: ${{ inputs.prompt || 'What are my active pull requests?' }}
           provider: ${{ inputs.provider || 'bedrock' }}

.github/workflows/reusable-ci-failure-issue.yml

@@ -34,14 +34,14 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '20.x'
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/reusable-dependabot-auto-merge.yml

@@ -44,14 +44,14 @@ jobs:
     steps:
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
         with:
           github-token: ${{ steps.app-token.outputs.token }}
 

.github/workflows/reusable-pr-ai-review.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Check authorization
         id: auth
         if: github.event_name == 'pull_request_target'
-        uses: aws/agentcore-devx-devtools/.github/actions/check-collaborator@31aa3b031a86664e29861d68956e44b07cf21a74
+        uses: aws/agentcore-devx-devtools/.github/actions/check-collaborator@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
         with:
           subject: ${{ github.event.pull_request.user.login }}
           required-permission: write
@@ -106,13 +106,13 @@ jobs:
 
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Add agentcore-harness-reviewing label
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr-number.outputs.number }}
         with:
@@ -146,24 +146,24 @@ jobs:
             });
 
       - name: Checkout caller repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fetch Harness secrets from Secrets Manager
         if: inputs.secret_source == 'secrets-manager'
-        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74
+        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
         with:
           role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
           repo: HARNESS_AWS_ROLE_ARN, HARNESS_ARN
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: ${{ inputs.secret_source == 'github' && secrets.HARNESS_AWS_ROLE_ARN || env.HARNESS_AWS_ROLE_ARN }}
           aws-region: us-east-1
           unset-current-credentials: true
 
       - name: Set up Python 3.12 with uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: "3.12"
           activate-environment: true
@@ -183,7 +183,7 @@ jobs:
 
       - name: Remove agentcore-harness-reviewing label
         if: always()
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr-number.outputs.number }}
         with:

.github/workflows/reusable-pr-automerge.yml

@@ -52,7 +52,7 @@ jobs:
     steps:
       # Checkout is only needed for the filesystem-detection fallback. Fetch a shallow tree.
       - name: Checkout (for language detection)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
@@ -118,7 +118,7 @@ jobs:
     steps:
       - name: Check CI status
         id: ci-status
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           REQUIRED_CHECKS: ${{ needs.resolve-config.outputs.required_checks }}
           MATCH_MODE: ${{ needs.resolve-config.outputs.match_mode }}
@@ -154,7 +154,7 @@ jobs:
 
       - name: Auto-merge PR
         if: steps.ci-status.outputs.result == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           COMMIT_TITLE_PREFIX: ${{ needs.resolve-config.outputs.commit_title_prefix }}
         with:

.github/workflows/reusable-pr-labeler.yml

@@ -46,7 +46,7 @@ jobs:
       # let actions/labeler resolve it from the workspace. Under
       # pull_request_target this checks out the base ref, NOT the untrusted PR head.
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       # Resolve the labeler config path (consumers use the v5+ `changed-files:` schema).
       - name: Detect labeler config
@@ -63,7 +63,7 @@ jobs:
 
       # Mirrors the live `pr-labeler.yml`: actions/labeler@v6 + repo-token.
       - name: Label by changed files (labeler v6)
-        uses: actions/labeler@v6
+        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: ${{ steps.detect.outputs.config-path }}

.github/workflows/reusable-pr-security-review.yml

@@ -100,7 +100,7 @@ jobs:
       - name: Check authorization
         id: auth
         if: github.event_name == 'pull_request_target'
-        uses: aws/agentcore-devx-devtools/.github/actions/check-collaborator@31aa3b031a86664e29861d68956e44b07cf21a74
+        uses: aws/agentcore-devx-devtools/.github/actions/check-collaborator@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
         with:
           subject: ${{ steps.subject.outputs.login }}
           required-permission: write
@@ -119,20 +119,20 @@ jobs:
       AWS_REGION: us-west-2
     steps:
       - name: Fetch secrets from Secrets Manager
-        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74
+        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
         with:
           role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
           shared: BEDROCK_SECURITY_REVIEW_ROLE_ARN
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Resolve PR
         id: pr
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER_INPUT: ${{ inputs.pr_number }}
         with:
@@ -163,7 +163,7 @@ jobs:
             core.setOutput('base_ref', pr.base.ref);
 
       - name: Add reviewing label
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr.outputs.number }}
         with:
@@ -195,7 +195,7 @@ jobs:
             });
 
       - name: Checkout PR head
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.pr.outputs.head_sha }}
           fetch-depth: 0
@@ -227,7 +227,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: steps.diff.outputs.bytes != '0'
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: ${{ env.BEDROCK_SECURITY_REVIEW_ROLE_ARN }}
           aws-region: us-west-2
@@ -236,7 +236,7 @@ jobs:
       - name: Run Claude Code
         id: review
         if: steps.diff.outputs.bytes != '0'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@6d5ae526d25ce88daa2200be073e1a373167f064 # v1
         with:
           github_token: ${{ steps.app-token.outputs.token }}
           use_bedrock: "true"
@@ -455,7 +455,7 @@ jobs:
 
       - name: Post summary
         if: always()
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr.outputs.number }}
           FINDING_COUNT: ${{ steps.findings.outputs.count }}
@@ -500,7 +500,7 @@ jobs:
 
       - name: Remove reviewing label
         if: always()
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr.outputs.number }}
         with:

.github/workflows/reusable-pr-size-title.yml

@@ -46,7 +46,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Calculate PR size and apply label
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const prNumber = context.payload.pull_request.number;
@@ -144,7 +144,7 @@ jobs:
       pull-requests: read
       statuses: write
     steps:
-      - uses: amannn/action-semantic-pull-request@v6.1.1
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: